Bitween redesign: the new admin UI on the r10.0 line

[hamzahalq]

The redesigned Bitween admin UI, served by the backend, plus the backend work it needed. This opens the r10.0 line; the .NET 10 upgrade itself is a separate PR on top of this one, deliberately kept apart so a runtime failure can't be ambiguous between "new UI" and "new framework".

How to read 357 files

The line count is dominated by generated and new-file content, not by changes to review:

	files	added
SW.Bitween.Web/ClientApp — the new SPA	179	+28,385
EF migration + Designer snapshots (3 providers)	32	+26,209
SW.Bitween.Api — the actual backend change	121	+2,340 / −205
Sdk, tests, charts, Dockerfile, Startup	27	+828

The branch is 10 commits, one per area, each a coherent slice. Read it commit by commit, not file by file:

#	commit	files
1	serve the admin UI from the backend	5
2	the redesigned admin UI (on mock data)	158
3	sign in against the real backend	3
4	partners and information types	15
5	global values, work groups, retry policies	8
6	integrations, adapters and gateways	11
7	exchanges, operations, schedule timezones	14
8	notifiers, mapper editor, adapter pickers	12
9	permission catalog, roles, team page	110
10	settings	21

Each commit's tree is a state that really existed on the original branch, so this is bisectable — and every one of the ten was verified to build (C# and tsc) before being pushed, not just the tip.

Merge resolutions worth a look

releases/r10.0 was merged into this branch so the conflicts are resolved here, in the open, rather than inside the merge commit that lands it. Three needed a decision:

• Accounts/Create.cs — r8's DisableEmailPasswordLogin and this branch's RBAC rewrite both changed the same lines. Both kept: roles come from RoleIds, and a Microsoft-only instance creates accounts with no password. RuleFor(i => i.Role).NotNull() was dropped, since Role became optional in favour of RoleIds. Lands in commit 9.
• Subscriptions/Search.cs — merged without a conflict but did not compile: RetryPolicyId was added on both sides, so git kept both (CS1912). Deduped. Worth knowing that a clean auto-merge produced a broken tree here.
• SW.Bitween.Api.csproj — whitespace only.

One regression the merge caused, fixed here

DisableEmailPasswordLogin (r8, #230) was enforced by the backend but unknown to the new sign-in page, which still offered a form the Login handler would reject. It's now a proper setting in the catalog, and the page hides the form when it's on — including the case where it's on with no MSAL configured, which would otherwise render an empty card.

Verification

check	result
dotnet build SW.Bitween.sln	0 errors
C# unit tests	179 passed, 7 skipped
tsc -b / yarn lint / yarn build	clean; 0 lint errors
vitest	58 passed
Playwright	42 passed, 1 failed

The Playwright failure is exchanges.spec.ts:17 — pre-existing data drift, where the fixture exchange has aged past page 1 of 25. It fails identically before this merge.

Integration tests are Testcontainers-based and were compiled but not run (they need Docker).

Follow-up PRs, not in scope here

1. .NET 10 upgrade — 13 TFMs, Dockerfile bases, and the CI inputs (dotnet-version, major-version, and the hardcoded releases/r8.0 job gate, which currently makes every releases/r10.0 push a no-op). Dependabot has already written part of it in chore(deps): bump dotnet/sdk from 8.0 to 10.0 #197 and chore(deps): bump dotnet/aspnet from 8.0 to 10.0 #199, both aimed at releases/r8.0 where they'd break the image — retarget rather than redo. Bump Npgsql.EntityFrameworkCore.PostgreSQL from 8.0.11 to 9.0.4 #220 and Bump Pomelo.EntityFrameworkCore.MySql from 8.0.3 to 9.0.0 #221 (EF 9 providers) are in the same boat.
2. .github/dependabot.yml hardcodes target-branch: releases/r8.0 in all three ecosystems, so Dependabot will never see releases/r10.0.

🤖 Generated with Claude Code

[gitguardian]

⚠️ GitGuardian has uncovered 8 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
3998894	Triggered	Generic Password	62c5acc	SW.Bitween.Web/ClientApp/e2e/retry-policies.spec.ts	View secret
3998894	Triggered	Generic Password	47ac99e	SW.Bitween.Web/ClientApp/e2e/exchanges.spec.ts	View secret
3998894	Triggered	Generic Password	62c5acc	SW.Bitween.Web/ClientApp/e2e/global-values.spec.ts	View secret
3998894	Triggered	Generic Password	cae9079	SW.Bitween.Web/ClientApp/e2e/information-types.spec.ts	View secret
3998894	Triggered	Generic Password	47ac99e	SW.Bitween.Web/ClientApp/e2e/dashboard.spec.ts	View secret
3998894	Triggered	Generic Password	5456b05	SW.Bitween.Web/ClientApp/e2e/integrations.spec.ts	View secret
3998894	Triggered	Generic Password	5456b05	SW.Bitween.Web/ClientApp/e2e/gateways.spec.ts	View secret
3998894	Triggered	Generic Password	62c5acc	SW.Bitween.Web/ClientApp/e2e/work-groups.spec.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (5)

• ^main$
• ^master$
• ^staging$
• ^development$
• ^gigstaging$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8759e2c8-cbf2-4356-b34d-2218e0752a59

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}